Splunk Search

how to combine 2 separate queries and list there data in tabular format.

Aps17
Explorer

e.g

QUERY 1: host=jtcstcxbsswb* source="/usr/IBM/HTTPServer/logs/access*" httpmethod="GET" statuscode="200" loaninfo="/api*" OR Requestinfo="*/" OR sitename="*/LoginAccountUserName"

|eval APFields=split(loaninfo,"/")

|eval APNumOfFields=mvcount(APFields)

|eval AP2ndFromLast=mvindex(APFields,APNumOfFields-2)

|eval APLoanNumber=mvindex(APFields,6)

|eval APLast=mvindex(APFields,-1)

|search APLast="loans" OR APLast="summary" OR APLast="payments"

|timechart count(APLast), Avg(cookie) as URT  by APLast

 

Query 2 :sourcetype=apigee:digit* host=JTCLSGLAPGERT* APIProduct=*-Authenticated-Product
|timechart span=5m distinct_count(LoginAccountUserName)

i want something like this

 

host=jtcstcxbsswb* source="/usr/IBM/HTTPServer/logs/access*" httpmethod="GET" statuscode="200" loaninfo="/api*" 

|eval APFields=split(loaninfo,"/")

|eval APNumOfFields=mvcount(APFields)

|eval AP2ndFromLast=mvindex(APFields,APNumOfFields-2)

|eval APLoanNumber=mvindex(APFields,6)

|eval APLast=mvindex(APFields,-1)

|search APLast="loans" OR APLast="summary" OR APLast="payments"

|stats count(APLast), Avg(cookie) as URT  by APLast

|append [search sourcetype=apigee:digit* host=JTCLSGLAPGERT* APIProduct=*-Authenticated-Product
|timechart span=5m distinct_count(LoginAccountUserName) ]
 |bin _time|stats count(APLast), Avg(cookie) as URT ,distinct_count(LoginAccountUserName) by APLast


I am able to get the data  as 
Time  | count(APLAST) | URT | LoginAccountUserName (I see only zero values in LoginAccountUserName)


how to fetch the LoginAccountUserName data from 2nd query and list it here.

Labels (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Looking at the last bits of the merged query

|stats count(APLast), Avg(cookie) as URT  by APLast
|append [search sourcetype=apigee:digit* host=JTCLSGLAPGERT* APIProduct=*-Authenticated-Product
  |timechart span=5m distinct_count(LoginAccountUserName) ]
|bin _time
|stats count(APLast), Avg(cookie) as URT ,distinct_count(LoginAccountUserName) by APLast

we see that before the append we have results containing fields APLast, count(APLast), and URT.

The append command produces additional results with fields _time, and distinct_count(LoginAccountUserName).

The final stats command then attempts to blend the two sets of results by the APLast field. but cannot do so because append did not return a field by that name.

The bin_time command is wasted since the final stats command does not use _time.

I hope that explains why you're not getting the expected results.  I can't offer a solution to the problem because I don't know your data well enough to determine how to relate LoginAccountUserName to anything else.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...